Ilmu Komputer & AI editorial
Open AccessOA2026
Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgery
A constrained-hardware reproduction of the Reprompt attack on Stable Diffusion XL, with detector instrumentation and a falsified prediction
Saifur Rahman Tamim; Md Taslimul Hasan Toufique; A. M. Tayeful Islam· 2026· DOI 10.48550/arXiv.2609.12909
The core problem
Semantic watermarking schemes such as Tree-Ring embed a detectable pattern in the initial noise latent of a diffusion model, allowing a detector to verify image provenance without access to the generation key. Recent work by Müller et al. demonstrates that these watermarks are not only removable but forgeable: an attacker who never observes the watermarking key can still produce images that the genuine detector accepts. This digest reports a reproduction of the Reprompt forgery attack against Tree-Ring on Stable Diffusion XL (SDXL), conducted under substantially tighter hardware constraints than the original study. The original work used NVIDIA A40 GPUs; this reproduction ran on free-tier dual T4 GPUs with 14.6 GB of usable memory per device. Beyond reproduction, the study instruments the released detector to recover a discarded test statistic and evaluates two natural scores derived from it. The central questions are whether the attack reproduces under reduced memory, whether the detector's internal signal can be made more informative, and whether source-level predictions about detector behavior survive measurement.
Innovation
The attack reproduces. Over six trials of three arms, the genuine detector accepts genuine images 6/6 times, clean images 0/6 times, and forged images 5/6 times. The per-attack runtime is 325–332 seconds. The recovered detector statistic matches the released detector exactly, confirming that the inversion is faithful. The two scores built from the recovered statistic separate the forged arm from the clean null at AUC 0.861 and 0.972 on the same eighteen observations. The controlled probe confirms that the half-precision patch leaves the detector statistic unchanged, ruling out a precision-induced artifact. A prediction made from reading the detector source—that a particular property of the statistic would hold—was contradicted by the measurements. The following Mermaid diagram summarizes the experimental flow and the detector instrumentation:
Semantic watermarking schemes such as Tree-Ring embed a detectable pattern in the initial noise latent of a diffusion model, allowing a detector to verify image provenance without access to the generation key. Recent work by Müller et al. demonstrates that these watermarks are not only removable but forgeable: an attacker who never observes the watermarking key can still produce images that the genuine detector accepts. This digest reports a reproduction of the Reprompt forgery attack against Tree-Ring on Stable Diffusion XL (SDXL), conducted under substantially tighter hardware constraints than the original study. The original work used NVIDIA A40 GPUs; this reproduction ran on free-tier dual T4 GPUs with 14.6 GB of usable memory per device. Beyond reproduction, the study instruments the released detector to recover a discarded test statistic and evaluates two natural scores derived from it. The central questions are whether the attack reproduces under reduced memory, whether the detector's internal signal can be made more informative, and whether source-level predictions about detector behavior survive measurement.
The reproduction follows the released code of Müller et al. for the Reprompt forgery attack against Tree-Ring on SDXL. The experimental design comprises three arms: genuine images generated with the watermarking key, clean images generated without any watermark, and forged images produced by the attack without key access. Six trials are run across the three arms, yielding eighteen observations. The attack is executed on dual T4 GPUs with 14.6 GB of usable memory per device, requiring half-precision (FP16) execution. Because SDXL's pipeline makes direct autoencoder calls that are incompatible with half precision, the pipeline is patched to route those calls through a half-precision-safe path. A controlled probe verifies that the patched path leaves the detector statistic unchanged. The released detector computes a non-central chi-squared statistic but returns only its cumulative distribution function (CDF). The discarded statistic is recovered by inverting the CDF relationship. Formally, if the detector returns
, where is the non-central chi-squared CDF with degrees of freedom and non-centrality , the recovered statistic is
. Two natural scores are then built from the recovered statistic: one based on its raw value and one based on a normalized variant. Detection performance is summarized by the area under the receiver operating characteristic curve (AUC) over the eighteen observations. The attack runtime is measured per trial. All measurement artifacts, the notebook, and a pinned fork are released with the paper.
Why it matters
The reproduction confirms that the Reprompt forgery attack against Tree-Ring is robust to a substantial reduction in per-GPU memory: the original study used A40 GPUs, while this work used T4 GPUs with 14.6 GB usable memory per device. The 5/6 forgery success rate is consistent with the attack's reported effectiveness, and the 0/6 clean acceptance rate confirms that the detector does not trivially accept unwatermarked images. The runtime of 325–332 seconds per attack is practical for an adversary with modest resources. The instrumentation result is perhaps the most consequential: the released detector discards a statistic that, when recovered, yields scores with AUC up to 0.972. This suggests that the detector's current output—only the CDF—underutilizes available information. The two scores separate forged from clean images on the same eighteen observations, indicating that a simple modification to the detector's reporting could improve forensic discrimination. The falsified prediction from source reading underscores the value of measurement: static analysis of detector code can suggest properties that do not hold under execution. The half-precision patch is validated as non-interfering, which matters because constrained hardware is the norm for many researchers. The release of the notebook, pinned fork, and measurement artifacts supports reproducibility. Future work could explore whether the recovered statistic generalizes to other semantic watermarking schemes, whether the scores remain discriminative under adaptive attacks, and whether the detector can be hardened by incorporating the recovered statistic into its decision rule.
Who should read this
CS practitioners and researchers
Opening member content…